usdtransfer24[.]com

usdtransfer24.com was registered on 21 February 2026 through Key‑Systems GmbH. The domain resolves to 172.67.176.236, an address owned by Cloudflare, Inc. (AS13335) and is served from the United States. Authoritative nameservers are chan.ns.cloudflare.com and damiete.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. The site presents an HTTP 403 response and the sole visible page title is “Just a moment…”, indicating that the server is deliberately restricting access, a behavior commonly observed in phishing infrastructure that relies on Cloudflare challenge pages. The TLS certificate is issued by Google Trust Services under the WE1 root, providing a valid certificate chain but offering no indication of the underlying payload.

Threat intelligence shows the domain appears on one security blocklist and is explicitly blocked by PhishDestroy. On VirusTotal, four of ninety‑five scanning engines flagged the domain, contributing to its elevated risk rating. Gridinsoft assigns a trust score of 0 / 100, reinforcing the classification as malicious. The domain is currently taken offline, limiting the ability to collect additional artifacts such as page content, redirection chains, or credential‑stealing scripts.

Given the observable infrastructure—recent registration, Cloudflare hosting, a challenge page, low trust scores, and multiple vendor detections—the domain is highly likely to have been used for generic phishing operations. However, the exact phishing campaign, targeted brand, or victim demographic remains unknown because the content has not been captured. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any re‑registration or resurrection of the host, and consider adding the IP address 172.67.176.236 to network‑wide deny lists.